From nobody Mon Apr 6 09:13:43 2026 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A1D4C3A5422; Thu, 19 Mar 2026 22:59:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=193.142.43.55 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773961168; cv=none; b=dkyAcjcCJ9IbRjkRGN+lHGsTK0mz0AHa55LY/0+ZVJKga8Elt8sjalrhVFUoE3Rvmh/oKhwKvv1QsJHEZ2E325HN5iVoiTNxniJzicC5nDWHDgsrxUwkhR/67wfdyShUXnYhU+ngBg246J75XRoVqxHWSgzWad+GrmT54DuYlUg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773961168; c=relaxed/simple; bh=5RS8DAAWFkbgEXQynChSkn/0ZdgxJCRqyYLgy3kYGD4=; h=Date:From:To:Subject:Cc:In-Reply-To:References:MIME-Version: Message-ID:Content-Type; b=HPdxmrQ3NESWdc5ZNivtPt4UkJrt5UkEef2GY5B8WFRzw4YS2h3ZvXhUeqRJmyt9Vb5bv7BuSEYvLjYO5ThbXF6h42v0WYjAqsrsxS4PTV2xy/SkCm/y0PnJs26FQ1OdlvrzsHEAM3T5CEgLE2Tb3EjgqOR26RjX9+v7s3oxa6k= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de; spf=pass smtp.mailfrom=linutronix.de; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=IXiKHYT3; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=Ya2wXlz3; arc=none smtp.client-ip=193.142.43.55 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linutronix.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="IXiKHYT3"; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="Ya2wXlz3" Date: Thu, 19 Mar 2026 22:59:24 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1773961166; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=hjK8+fb/DoLeN3ddbgVdf0veO6i7Nbfqzdi4EtWdUHQ=; b=IXiKHYT3YZ2mWar7v3eVATV+rmtb1ENgMqWplIviI3mrT1MTVV/pSTuFxmU18Snrlbt5WO b8jYcaap8fwncbvsZiW2K1rl0yvYdK24akhW7P7XGdfAs/hMHDVAgHYcMDIZD6KOnGd2/H eGbgtX5jUf2gA5BECPVyLKl25ItyWj45UA0k4zckR4EHr2ByG8JRs86+2b/p1q+6Ojg7ZY KONWmYJdu6SGDe3DfV9MSO74jjCWoutqgaKdzGGy0D1O/jMbQ/hnB1cWzqsIV/j06KhmwF 5VKi5YjqanN3hsW8lQ+5zpGU33Fx2qRKwp+uPH0pu9nmFEq2kes2P3ExIJLs1A== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1773961166; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=hjK8+fb/DoLeN3ddbgVdf0veO6i7Nbfqzdi4EtWdUHQ=; b=Ya2wXlz38Uc2viINcPWsY/4vq7EFPJhMX8PTdQuVywK+By2hIcgLdKW1xA9B9ElIRes91c FPhbgBzx0WBK59BA== From: "tip-bot2 for Sohil Mehta" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: x86/cpu] x86/vsyscall: Disable LASS if vsyscall mode is set to EMULATE Cc: Sohil Mehta , Dave Hansen , Rick Edgecombe , "H. Peter Anvin (Intel)" , "Maciej Wieczor-Retman" , x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: <20260309181029.398498-5-sohil.mehta@intel.com> References: <20260309181029.398498-5-sohil.mehta@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-ID: <177396116490.1647592.4794294384096117238.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails Precedence: bulk Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable The following commit has been merged into the x86/cpu branch of tip: Commit-ID: b36d1f53d90c869d5f02fe0d8603f825013e746e Gitweb: https://git.kernel.org/tip/b36d1f53d90c869d5f02fe0d8603f8250= 13e746e Author: Sohil Mehta AuthorDate: Mon, 09 Mar 2026 11:10:28 -07:00 Committer: Dave Hansen CommitterDate: Thu, 19 Mar 2026 15:11:13 -07:00 x86/vsyscall: Disable LASS if vsyscall mode is set to EMULATE The EMULATE mode of vsyscall maps the vsyscall page with a high kernel address directly into user address space. Reading the vsyscall page in EMULATE mode would cause LASS to trigger a #GP. Fixing the LASS violation in EMULATE mode would require complex instruction decoding because the resulting #GP does include the necessary error information, and the vsyscall address is not readily available in the RIP. The EMULATE mode has been deprecated since 2022 and can only be enabled using the command line parameter vsyscall=3Demulate. See commit bf00745e7791 ("x86/vsyscall: Remove CONFIG_LEGACY_VSYSCALL_EMULATE") for details. At this point, no one is expected to be using this insecure mode. The rare usages that need it obviously do not care about security. Disable LASS when EMULATE mode is requested to avoid breaking legacy user software. Also, update the vsyscall documentation to reflect this. LASS will only be supported if vsyscall mode is set to XONLY (default) or NONE. Signed-off-by: Sohil Mehta Signed-off-by: Dave Hansen Reviewed-by: Rick Edgecombe Reviewed-by: Dave Hansen Reviewed-by: H. Peter Anvin (Intel) Tested-by: Maciej Wieczor-Retman Link: https://patch.msgid.link/20260309181029.398498-5-sohil.mehta@intel.com --- Documentation/admin-guide/kernel-parameters.txt | 4 +++- arch/x86/entry/vsyscall/vsyscall_64.c | 5 +++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentatio= n/admin-guide/kernel-parameters.txt index cb850e5..64df2c5 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -8376,7 +8376,9 @@ Kernel parameters =20 emulate Vsyscalls turn into traps and are emulated reasonably safely. The vsyscall page is - readable. + readable. This disables the Linear + Address Space Separation (LASS) security + feature and makes the system less secure. =20 xonly [default] Vsyscalls turn into traps and are emulated reasonably safely. The vsyscall diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscal= l/vsyscall_64.c index e740f3b..ea36de9 100644 --- a/arch/x86/entry/vsyscall/vsyscall_64.c +++ b/arch/x86/entry/vsyscall/vsyscall_64.c @@ -62,6 +62,11 @@ static int __init vsyscall_setup(char *str) else return -EINVAL; =20 + if (cpu_feature_enabled(X86_FEATURE_LASS) && vsyscall_mode =3D=3D EMULAT= E) { + setup_clear_cpu_cap(X86_FEATURE_LASS); + pr_warn_once("x86/cpu: Disabling LASS due to vsyscall=3Demulate\n"); + } + return 0; } =20